Colorado and the EU Kept AI Disclosure and Dropped AI Assessment

← Back · ACT III · Chapter 19: Preemptive Value Architecture

Two of the statutes an enterprise might have been waiting on were rewritten this year, and it is worth being precise about which parts changed. The obligations that survived in both are the ones that require somebody to be told that an automated system was used. The obligations that were removed in one and postponed in the other are the ones that would have required somebody to examine what the system did.

Colorado went first. On 14 May 2026 Governor Jared Polis signed SB26-189, which repeals the Colorado AI Act and replaces it with a narrower statute. The 2024 law was the first comprehensive state AI statute in the country, and it required deployers of high-risk systems to maintain a risk management program, to complete impact assessments, and to use reasonable care to protect consumers from algorithmic discrimination. The new law drops all three.

What it keeps is a set of notice duties. A deployer has to tell a consumer in advance when automated decision-making technology will materially influence a decision about them. If that decision produces an adverse outcome, the deployer has thirty days to explain the decision and the role the technology played in it, and to offer review by a person with the authority to override the result. Developers have to give deployers technical documentation covering intended uses, categories of training data used, and known limitations. Both sides keep compliance records for three years. The statute takes effect on 1 January 2027, subject to a pending federal challenge by one of the model developers.

Reading that list against what was struck, the pattern is not subtle. Every surviving duty asks the deployer to say something. The one duty that asked it to examine the system before relying on it is the one that is gone.

Europe Reached The Same Division By A Different Route

The Digital Omnibus on AI entered into force on 27 July 2026, six days before the AI Act’s high-risk obligations were due to apply, and moved them. Stand-alone high-risk systems under Annex III, which covers hiring, credit assessment, education and similar decisions, now apply from 2 December 2027. AI embedded in regulated products moves to 2 August 2028. The deployer obligations for high-risk systems sit inside that block and moved with it.

What did not move is Article 50. The transparency obligations took effect on 2 August 2026 as originally scheduled, so a person interacting with an AI system still has to be told they are, and generated content has to be marked, with systems already on the market given until 2 December 2026 to meet the machine-readable marking duty.

The deferral is defensible on its own terms, and the lawyers reading it closely have said so. The harmonized standards and the national authorities were not ready, a requirement nobody can conform to is not much of a requirement, and this is a postponement rather than a dismantling. I have no quarrel with any of that. I would only note what needed the extra sixteen months and what did not. The assessment obligations needed them and the disclosure obligations did not, which is the division Colorado reached by repeal rather than by deferral.

Neither Statute Asks The Question A Buyer Is Asking

Both regimes exist to protect the person on the other end of an automated decision. That is a legitimate purpose and it is not mine. Neither of them asks whether the system delivered what the organization bought it for, and that absence is consistent across every version of both laws, before amendment and after.

I wrote earlier this month about the complaint channel Europe opened for companies that build products on somebody else’s model, and the pattern there was the same. Every ground a complaint can rest on concerns what the supplier disclosed, and none of them reaches whether the capability produced the outcome the buyer funded.

This matters because the dates are being used as a plan. Compliance teams are working toward December 2027 and January 2027, which is sensible work. The error I keep running into is in what people expect those dates to deliver. The December date is described in budget meetings as the point at which vendor claims will finally have to hold up. They will not have to hold up, because vendor claims to the buyer are not what either statute is about. An enterprise that arrives at 2 December 2027 fully compliant will still have no independent answer to the question its board has been asking since the first agentic contract was signed, which is whether any of this produced what it was supposed to produce.

Which Leaves The Obligation With The Party Paying

That is the ordinary way a requirement enters a commercial relationship anyway. The buyer writes it into the purchase before signature, when the supplier still wants the deal and the terms are still open.

The terms are not complicated. What is this deployment meant to produce, stated in numbers the organization already reports. What evidence would settle whether it did. Who produces that evidence, on what cadence, and who reads it when it arrives. A supplier that agrees to those terms has agreed to be measured against them, and a supplier that will not agree has told you something useful before any money has moved.

The professional bodies left this question without an instrument, which I wrote about in the standard that was folded into a framework for control. The legislatures have now demonstrated, twice in one year, that they are legislating something adjacent to it. A buyer who wants a verdict on whether the value arrived is going to be the one writing the requirement, and the useful part of that is the timing. Nothing in either statute has to happen first.

Related: The Deadline Moved. The Enforcement Landed Elsewhere.

Sources: Davis Wright Tremaine, “Colorado AI Act Repealed and Replaced by Narrower Statute Focused on Transparency Requirements and Enhanced Consumer Rights,” 21 May 2026, at dwt.com/blogs/privacy--security-law-blog/2026/05/colorado-ai-act-repeal-new-transparency-law, setting out SB26-189’s removal of the risk management program, impact assessment and reasonable care duties and the notice duties that replace them; the bill itself is at leg.colorado.gov/bills/sb26-189. Gibson Dunn, “EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes,” 27 May 2026, at gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/, for the deferred Annex III and Annex I dates and the unchanged Article 50 schedule. The Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force from 27 July 2026, at eur-lex.europa.eu/eli/reg/2026/1744/oj, which is where the deferred application dates for the high-risk regime, including the deployer obligations and the impact assessment, and the marking period for systems already on the market, are set out. Read 27 August 2026.

Keep reading: ACT III · Chapter 19: Preemptive Value Architecture